Privacy notice and cookies policy

We may collect certain information or data about you in various ways. The main circumstances we do so are below.

• When you submit enquiries or feedback through one of our website forms, leave a comment or sign up for email newsletters, contact our library service, or book a place at a King's Fund event we may collect your name, email address, telephone number and other information. including dietary requirements.  

• When you apply for our courses or awards, e.g., Circles programme or GSK IMPACT Awards we may collect your name, email address, role, organisation and other information.  

• When you apply to work at the Fund 

• When you use our website we will collect: 

• your IP address, and details of web browser and which version of it you used 

• information on how you use our website, using cookies, that will help us improve the website 

• details of transactions you carry out through our website and of the fulfilment of your orders.  

• When you participate in any of our research projects we may collect your name, contact and other details, including special category data.

• When you attend a course, conference or award ceremony we may collect images of you in films or photographs or, in respect of contributions you may make, audio recordings. 

• When you enter our building your image may be captured on CCTV.

• When you are employed by an organisation that has a tenancy on our Health Campus in Cavendish Square, we may collect your name, contact details and photograph (for security access).

• When you contact us directly, we may keep a record of that correspondence.

We have technical and organisational measures in place to keep your data secure once we receive it. These protective measures may include pseudonymising and encrypting personal data, firewalls, anti-virus and malware software, holding personal data in secure, confidential storage, and regularly assessing and evaluating the effectiveness of such measures. 

Online payment transactions are always encrypted. The King’s Fund is PCI DSS compliant. 

When sharing personal data with third parties as set out in this Privacy Notice, it may be transferred outside the UK. In these circumstances, your personal data will only be transferred on one of the following bases: 

• the country or territory to which the transfer is made ensures an adequate level of protection for personal data; 

• The King’s Fund and the recipient of the personal data outside the UK have signed a form of model data protection clauses (International Data Transfer Agreement or International Data Transfer Addendum) or 

• there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent to make the transfer). 

To find out more about the transfers by us of your personal data outside the UK and the countries concerned please contact us at [email protected]. 

We may use your personal information:

• to provide you with information, products or services that you request from us, or to process your booking in relation to an event or course we are organising 

• to make you aware of related products and services  

• to notify you of any changes to our services or products 

• to process your application to work at the Fund 

• to process your data relating to venue hire bookings (see KEHF Limited below) 

• to assist with any contractual obligations between us 

• to administer a research project or programme you participate in 

• to administer any courses or awards that you participate in, e.g., Circles programme, GSK IMPACT Awards 

• to provide a record of, or to promote and market a course, conference or award using images and film taken on the day

• for security and safety purposes using CCTV.

Products and services 

We need to process your personal data when we provide you with information, products and services that you have requested from us. We do so because it is necessary for our legitimate interests and/or because it is necessary for the performance of a contract to which you are a party or in order to take steps at your request before entering into a contract. 

Marketing 

When we send marketing communications to you at a business email address, we do so because it is necessary for our legitimate interests. Our legitimate interests include disseminating our independent research and analysis, as well as highlighting relevant courses and conferences, in order to fulfil our vision to improve health and care in England. You can request that we stop sending you marketing communications at any time (see 'Your Rights' below). 

In respect of personal email addresses, we will only send you marketing with your  consent and you can opt out at any time.  

Events

If you are an attendee of an event delivered by The King’s Fund we will process your data for administrative purposes. We do so because it is necessary for our legitimate interests to manage and provide the event. For the purposes of networking we may collect your personal data in the form of delegate lists when you attend an event organised by The King’s Fund, either in the building or online.

Open Programmes and courses

If you are a participant of an open programme or course delivered by The King’s Fund we will process your data for administrative purposes. We do so because it is necessary for our legitimate interests to manage and provide the programmes and courses. We may also collect limited diversity information which will only be used for internal monitoring purposes. Where this is special category data we will rely on an appropriate separate condition for processing under Article 9.

Organisational development(OD) 

We may need to process your personal data when we partner with your organisation during OD work. This is necessary for the performance of a contract to which you are a party or in order to take steps at your request before entering into a contract. 

Personal data gathered from publicly available sources 

We manually gather limited personal data from publicly available sources (such as announcements about job moves in the health sector) so that we can contact individuals who we think will be interested in our events or publications. We do so in connection with our legitimate interests as referred to above under 'Marketing'. We do not carry out automated extraction of data from the web (data scraping). 

Research 

If you participate in research into health and care that we conduct (for example, in relation to the management of health policy / services), we may need to collect and process your personal information. We do so because it is necessary for our legitimate interests in pursuing research into the health and care sector. We follow ethical guidelines when conducting research and will always keep you informed of your rights. 

Filming and photography at events 

We (or a third party) sometimes carry out filming (including audio recordings) or photography at events as part of our publicity/marketing output. We do so because it is necessary for our legitimate interests in promoting and disseminating our work. We make delegates aware of this in advance in the information pack provided and in signage at the event. We may also capture video and still images of you individually or in small groups, eg where we are interviewing you. We will seek consent from you before doing so.

For some events, audio recordings are processed using AI to produce post-session text summaries. These summaries are reviewed by King’s Fund staff, personal information is removed, and they are shared with delegates who were unable to attend all sessions.

CCTV footage

We use CCTV cameras at strategic points throughout our premises, primarily at all entrance and exit points, but also in some larger venue spaces. We do so because it is necessary for our legitimate interests in maintaining a safe and secure environment, protecting our property, supporting crime prevention and law enforcement, and ensuring compliance with health and safety regulations.

Tenants at Cavendish Square 

We need to process your personal data if you are an employee of an organisation that is a tenant on our Health Campus in Cavendish Square. This is necessary for the performance of a contract to which your organisation is party. 

Special category data

We may process your data that is special category, e.g. dietary requirements, ethnicity etc. relying on an appropriate lawful basis under Article 6 of the UK GDPR and a separate condition for processing under Article 9.

Other bases for processing 

We may need to process your personal data for compliance with our legal obligations, including where it is necessary for the prevention and detection of crime, or for the establishment, exercise or defence of legal claims (for example, to protect and defend our rights or property). 

For the purposes referred to in this Privacy Notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties. We may disclose limited personal data to a variety of recipients including: 

• our employees, agents and contractors where there is a legitimate reason for their receiving the information  

• KEHF Limited, our wholly owned trading company via which we manage certain commercial activity related to our charitable activities (see KEHF Limited below) 

• our Sponsors, if we hold an event they are supporting (and in respect of which we disclose details of who is attending that particular event) 

• attendees of an event you are participating in for networking purposes (name, role, and organisation in the form of an attendee list) 

• trusted partners for the delivery of a service or product, e.g., GSK for the administration of the GSK IMPACT Awards

• internal and external auditors and our legal advisers 

• when The King's Fund is legally required to do so (e.g., by a court, government body, law enforcement agency or other authority of competent jurisdiction), for example, by HM Revenue and Customs. 

We often work with third parties to help us provide our services and products to you. For example, if you wanted to attend one of our events we use a third party called EventBrite to manage the booking on our behalf.  

We have contracts in place with all our third parties to make sure they protect and respect your information with the same commitment as we do. For further information please contact us using the details below. 

We will retain your personal data no longer than is necessary for the purposes for which the personal data are processed. This purpose is set out in the ’How do we use your personal information?’ section above. For example, it may be kept for the duration of a service or product you receive from us or as part of our legal obligations. The King’s Fund has a corporate retention and disposal schedule. 

Under data protection legislation you have several rights concerning your personal data. These are: 

• the right to be informed what personal data we hold about you and/or to obtain access to it 

• the right to rectification of personal data we hold about you if it is inaccurate 

• the right to erasure of your personal data (in certain circumstances) 

• the right to restrict processing (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal) 

• the right to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller 

• the right to object on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights. 

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply: for example, if we have reason to believe the personal data we hold is accurate or we can show our processing is necessary for a lawful purpose set out in this notice. 

Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services. If you have given your consent and you wish to withdraw it, please contact us using the contact details as set out below.   

You can find out more about your rights under data protection legislation at www.ico.org.uk If you are not satisfied with how we are processing your personal data, you can make a complaint to the Information Commissioner. 

KEHF Limited (‘KEHF’) (registered company number 02754697 and with registered office at 11-13 Cavendish Square, London W1G 0AN) is the wholly owned trading subsidiary of The King's Fund and runs the venue hire business 11 Cavendish Square.  

KEHF will collect personal data relating to venue hire bookings (for example, the hirer's name and contact information) because it is necessary for the performance of a contract or to take steps at the hirer's request before entering into a contract.  

Where the individual making the booking is doing so in a business/work context (i.e., using a business email address) KEHF collects that information for marketing purposes, to be able to send details of offers or other services because it is necessary for KEHF's legitimate interests in promoting its business. KEHF will always provide the option to opt out of receiving such communications. Where the individual provides a personal email address, KEHF will only send marketing communications with their consent (and always with the option to opt out at any stage). 

If the hirer provides KEHF with any health-related information of attendees (for example, allergy information or particular dietary requirements) KEHF processes this information on the basis of consent for the event in question and for the purpose of protecting the wellbeing of such attendees. 

Please see the 'Your rights' section above, which also applies in respect of KEHF, and you can contact us via the details below if you have any queries. 

Our data protection lead is the  Information Governance Manager, Tim Judkins. If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, you can contact us at: [email protected]